What happened
The managing agent emailed two owners’ personal data to the wrong address: names, emails, the last four digits of bank account numbers and maintenance-fund payments. When asked, the agent could not produce its data protection policies. Complaints reached the PDPC on 31 March and 22 April 2025.
What the PDPC decided
The MCST breached the Accountability Obligation, with no data protection officer and no policies, and the Protection Obligation. The MCST received directions to put things right, as reported by Baker McKenzie. The managing agent signed a voluntary undertaking on 9 February 2026.
What this means for your MCST
1. Appoint your own data protection officer, even if the managing agent runs the estate.
2. Adopt your own policies, and check the agent’s practices against them.
3. Put data protection clauses in the agent’s contract, and review them each year.